Skip to content
OpenAdvisories

Vendor

Microchip

24 known vulnerabilities.

Microchip at a glance

Last 12 months
11
Critical · all time
2
Exploited · all time
0
Public exploit · all time
4
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 3 vulnerabilities, 2 critical March 2026: 1 vulnerability Mar April 2026: 1 vulnerability May 2026: 0 vulnerabilities June 2026: 4 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 1 vulnerability September 2026: 1 vulnerability Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202610
Aug 202610
Jul 202600
Jun 202640
May 202600
Apr 202610
Mar 202610
Feb 202632
Jan 202600
Dec 202500
Nov 202500
Oct 202530
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

TimeProvider 4100 7 Time Provider 4100 5 GridTime 3000 4 TimePictra 2 RN4870 1 MPLAB® Harmony 3 Core Module 1 AN1044 1 AN953 1 SW300052 1 SAME70 1 SAMS70 1 SAMV70 1 SAMV71 1 SAMG55 1 SAM4C 1 SAM4S 1 SAM4N 1 SAM4E 1 SAM3S 1 SAM3N 1 SAM3U 1 IStaX 1 SAMA5D4 1
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Medium 5.6
    CVE-2026-89172

    Side-channel attack of AN1044/AN953/SW300052 cryptographic algorithms

    Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affects AN1044: through A; AN953: through A; SW300052: through 2.6.

    Microchip AN953 AN1044 SW300052
  • High 7.3
    CVE-2026-18349

    SAMA5D44 Fault Injection Vulnerability

    Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection. This issue affects SAMA5D4.

    Microchip SAMA5D4
  • Medium 4.6
    CVE-2026-12620

    Access Token Exposure in URL Parameters in GridTime™ 3000 GNSS Time Server

    The GridTime 3000 GNSS Time Server leaks the access token in the URL parameters of some endpoints. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • Medium 5.3
    CVE-2026-12621

    Cross-Site Scripting (XSS) Vulnerability in Password Reset Redirect in GridTime™ 3000 GNSS Time Server

    Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0r0.03 before 1.2r0.0.

    Microchip GridTime 3000
  • Medium 5.3
    CVE-2026-12622

    Open Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time Server

    The GridTime 3000 GNSS Time Server has an open redirect vulnerability in the password change form submission. This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • Medium 5.1
    CVE-2026-12619

    GridTime™ 3000 GNSS Time Server CSRF to XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This issue affects GridTime 3000: from 1.0r0.03 through 1.1r0.0.

    Microchip GridTime 3000
  • High 8.7
    CVE-2026-2336

    Weak webstax_auth Cookie Authentication Allows Privilege Escalation

    A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax_auth session cookie and forge a new cookie with administrative privileges.This issue affect…

    Microchip IStaX
  • Medium 5.5
    CVE-2025-9497

    Hardcoded Upgrade Decryption Passwords

    Use of Hard-coded Credentials vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.0.

    Microchip Time Provider 4100
  • Critical 9.3
    CVE-2026-3010

    TimePictra Stored Cross-Site Scripting

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2.

    Microchip TimePictra
  • Critical 9.3
    CVE-2026-2844

    TimePictra Authentication Bypass Vulnerability

    Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2.

    Microchip TimePictra
  • Medium 5.7
    CVE-2025-47904

    Unsigned upgrade package

    Download of Code Without Integrity Check vulnerability in Microchip Time Provider 4100 allows Malicious Manual Software Update.This issue affects Time Provider 4100: before 2.5.

    Microchip Time Provider 4100
  • High 7.1
    CVE-2025-47902

    SQL Injection in web resource

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time Provider 4100: before 2.5.

    Microchip Time Provider 4100
  • High 8.9
    CVE-2025-47901

    RCE on restore configuration password

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

    Microchip Time Provider 4100
  • High 8.9
    CVE-2025-47900

    RCE on backup configuration password

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affects Time Provider 4100: before 2.5.

    Microchip Time Provider 4100
  • Medium 4.3
    CVE-2024-29155

    Denial of service on Microchip RN4870 devices

    On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, cau…

    Microchip RN4870
  • High 8.7
    CVE-2024-43683

    Improper verification of the Host header in TimeProvider 4100

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Microchip TimeProvider 4100 allows XSS Through HTTP Headers.This issue affects TimeProvider 4100: from 1.0.

    Microchip TimeProvider 4100
  • High 8.7
    CVE-2024-43684

    Cross-Site Request Forgery vulnerability in TimeProvider 4100

    Cross-Site Request Forgery (CSRF) vulnerability in Microchip TimeProvider 4100 allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0.

    Microchip TimeProvider 4100
  • High 8.7
    CVE-2024-43685

    Session token fixation in TimeProvider 4100

    Improper Authentication vulnerability in Microchip TimeProvider 4100 (login modules) allows Session Hijacking.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • Medium 5.4
    CVE-2024-43686 EPSS 13%

    Reflected XSS in TimeProvider 4100 chart component

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • High 8.5
    CVE-2024-9054 Public exploit EPSS 16%

    Remote code Execution inTimeProvider® 4100

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This issue aff…

    Microchip TimeProvider 4100
  • High 7.7
    CVE-2024-43687 Public exploit

    XSS vulnerability in bannerconfig endpoint in TimeProvider 4100

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (banner config modules) allows Cross-Site Scripting (XSS).This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • Medium 6.3
    CVE-2024-7801 Public exploit

    SQL injection in get_chart_data in TimeProvider 4100

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip TimeProvider 4100 (Data plot modules) allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7.

    Microchip TimeProvider 4100
  • High 7.0
    CVE-2024-30212 Public exploit

    Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command

    If a SCSI READ(10) command is initiated via USB using the largest LBA (0xFFFFFFFF) with it's default block size of 512 and a count of 1, the first 512 byte of the 0x80000000 memory area is returned to the user. If the block count is increased, the full RAM ca…

    Microchip MPLAB® Harmony 3 Core Module
  • Medium 6.3
    CVE-2024-4760

    Voltage glitch during startup of the EEFC NVM controller can bypass the security bit

    A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

    Microchip SAM4E SAMS70 SAM3N